29375 matches found
CVE-2026-83947
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...
CVE-2026-83947
A missing authorization vulnerability in Azure Event Grid allows an authorized attacker to perform spoofing over a network. The issue is classified under CWE-862 and carries a HIGH base severity score of 7.7. While the specific root cause and affected versions are not detailed in the provided doc...
com.consol.citrus:citrus-vertx (2.2), com.erudika:para (>=1.5.1, <=1.8.0) +51 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.2.3)
com.hazelcast:hazelcast MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.consol.citrus:citrus-vertx 2.2 - com.erudika:para =1.5.1, =1.2.1, =1.4.4 -...
CVE-2026-107397
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
EUVD-2026-95253
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107394
The event management system Indico is vulnerable to a Server-Side Request Forgery (SSRF) flaw in versions prior to 3.3.13 . The root cause is an incomplete check in the Flask-Multipass authentication system, which failed to cover an edge case identified in a previous fix for CVE-2026-25738. This ...
EUVD-2026-95212
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...
CVE-2026-107391
The music-metadata library (NPM) versions >=11.0.0 and
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
GHSA-GCX5-HXJ7-GPQQ msgpack5: Quadratic parsing in the streaming decoder
Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...
CVE-2026-107297
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...
AZL-106842 CVE-2026-107297 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...
CVE-2026-107290
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...
CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...